feat(host_agent): each drive's health, read with smartctl, alertable (#5789)

The root helper gains one read-only action, `drives`: it finds the drives
itself (smartctl --scan-open), reads each as JSON, and writes a summary the
agent carries on every sample (agent 1.20.0). Steward judges the figures in
drives.py (failing / worn / watch / ok / no SMART / unreadable), records them
per drive and as host roll-ups for covering rules, keeps the newest report on
the registration and lists it on the host page.

install-deps.sh installs smartmontools with apt, dnf, yum, zypper, pacman or
apk, run by install.sh and every agent playbook; one it can't install is
reported, never fatal.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/mcp/test_tools.py

@@ -267,6 +267,8 @@ def test_get_host_groups_parts_by_kind_and_summarises_cores():
         "net:br-1": {"net_rx_bps": 900.0, "net_tx_bps": 0.0},
         "net:eth1": {"net_rx_bps": 0.0, "net_tx_bps": 0.0},
         "diskio:sda": {"disk_read_bps": 1.0, "disk_write_bps": 2.0},
+        "drive:sda": {"drive_failing": 0.0, "drive_bad_sectors": 0.0},
+        "drive:nvme0": {"drive_failing": 1.0, "drive_life_used_pct": 12.0},
         "temp:Package id 0": {"temp_c": 61.0},
     })
     got = agent_parts(parts, "box", limit=2)
@@ -280,6 +282,7 @@ def test_get_host_groups_parts_by_kind_and_summarises_cores():
     assert nets["total"] == 3 and nets["truncated"] is True
     assert "parts_limit" in nets["more"] and 'resource="box:<part>"' in nets["more"]
     assert got["disk_io"]["items"][0]["device"] == "sda"
+    assert [d["device"] for d in got["drive_health"]["items"]] == ["nvme0", "sda"]  # failing first
     assert got["temperatures"]["items"][0] == {"sensor": "Package id 0", "part": "temp:Package id 0",
                                                "temp_c": 61.0}
     assert "other" not in got